Expected Loss: How Do Simple Phone Habits Protect Online Accounts?

Simple phone habits protect online accounts by cutting the probability that an attacker gets in, which lowers the expected loss from every account linked to the device. Unique passwords, 2-step verification, prompt updates and careful handling of unexpected messages each take a few minutes, but together they make a phone a far less attractive target. Economics helps explain why these habits pay off and why many people still skip them.

Why Is a Phone Such a Valuable Target?

A single phone often holds logins for email, banking, shopping, subscriptions and reward apps. Whoever controls the phone, or the email account behind it, can often reset the passwords for everything else. That concentration makes the phone the front door to a person’s digital life.

The attackers also enjoy the benefit of scale. Sending an additional phishing text has very little cost to the criminal. The ability for spammers to send vast numbers of unsolicited e-mails creates an opportunity for them to make money from those who reply, with their low cost per message allowing them to remain profitable despite very low rates of success.

How Does Expected Loss Explain Account Security?

Economists measure risk using expected loss: the value of each possible loss multiplied by the probability that it happens, added up across all outcomes. A household cannot control how much an attacker wants its accounts, but it can reduce the probability of a successful break-in. For example, if an account holding £200 of earnings has a 5% chance of being taken over in a year, the expected loss is £10. Halving that probability halves the expected loss to £5 (figures are illustrative).

The number of accounts matters too. Someone researching how to make money from your phone, whether through reward apps, surveys or play-to-earn games, may soon have several new logins linked to payment details or earnings. Each one adds to the potential loss, which raises the value of protecting all of them well.

Correlated Risk: Why Do Unique Passwords Matter?

When risks are correlated, one bad event triggers several losses at once. Investors reduce this risk by diversifying so that a fall in one asset does not drag down the rest. Password reuse does the opposite. If one website leaks a password, every account using the same one is exposed, so the losses move together.

A unique password for each account breaks that link and keeps a single breach contained. The UK’s National Cyber Security Centre (NCSC) recommends using three random words to create a password that is difficult to crack and turning on 2-step verification for online accounts. It also suggests a password manager to create and remember separate passwords, and a strong, separate password for email, since email is often used to reset everything else. Where an account offers an authenticator app or a physical security key, these are generally considered harder to intercept than codes sent by text message.

Behavioural Biases: Why Do People Click on Phishing Messages?

Phishing works because people do not always weigh information carefully. Under time pressure, they fall back on heuristics, the mental shortcuts that research on decision-making bias shows can lead to poor choices. A message warning that an account will be closed within 24 hours is designed to trigger exactly this response.

Other biases are exploited too. Copying a bank’s or delivery firm’s branding plays on authority bias, the tendency to trust apparent figures of authority. Framing a request as a routine check makes it feel low-risk. Never assume that an inbound, unsolicited email, text or message is legitimate until you independently verify the source. You can do this by opening the app or going directly to the appropriate website, which provides you with the best opportunity to evaluate the situation through a trustworthy means of communication.

The Default Effect: Why Do Automatic Updates Protect Accounts?

People tend to stick with existing default settings, which is referred to as "status quo bias" by behavioural economists. This is known as the "default effect": people are more likely to take an action when it is set as the default.

Automatic updates apply this idea to security. The NCSC emphasises that security improvements can be made through software and application updates, and enabling automatic updates removes the need for the user to remember to manually install the updates themselves. Review of the app permissions is an additional level of protection. By limiting access to contacts and location and removing any unused applications, there is less risk of personal data becoming compromised if an application is hacked or exploited by malicious actors. Backing up photographs and other important documents, as the NCSC recommends, can reduce potential losses.

Why Does One Weak Account Put Others at Risk?

Poor security does not only harm the account holder. A compromised phone or messaging account can be used to send scams to friends, family and colleagues, who then face higher risks of their own. This is a negative externality: a cost imposed on third parties that the person making the decision does not bear.

Because others share the benefits of good security, individuals may invest less in it than society would like, a pattern similar to the free rider problem. This is a major reason that app developers and service platforms increasingly incorporate security protections as standard default features, instead of relying on individual user actions and decisions. Most importantly, basic security awareness and habits are typically the lowest-cost option to reduce potential loss across an entire network for both account holders and their connections.